@jakkrichm/create-nexus-devflow 2.17.9 → 2.18.1

package/template/.agents/skills/implement/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: implement
-description: "[devflow] Build and verify a task-isolated spec. Use for /implement or requests to implement an approved plan."
+description: "[devflow] Implement or start coding the active task-isolated spec on its branch in small steps, running tests after each step and presenting the configured review handoff. Use for /implement or requests to build or resume an approved spec."
 argument-hint: "[{run-id, number, or name}] [--ticket <NN | path>]"
 ---
 
-# implement - build and verify the target spec
+# implement - build the target spec, one reviewed step at a time
 
 **Context reuse:** Reuse any required file already loaded in project instructions or the current session. Read it again only if absent, changed, or exact current bytes or line references are needed.
 
@@ -20,23 +20,17 @@ Where this sits in the workflow:
 
 `/feature`, `/fix`, or `/rollback` wrote the spec to
 `devflow/context/{xxx-slug}/spec.md` and stopped.
-Build the selected spec through its acceptance criteria and required verification, then present the configured review handoff. Preserve authorization already given for this work. Read only relevant conventions and reuse loaded context.
-
-## Review cadence and checkpoints
-
-Read `workflow.stepReview` and `workflow.checkpointCommits` from `devflow/config.json` independently; defaults are `feature` and `disabled`.
-
-- `stepReview: "feature"`: continue through all authorized steps without asking Continue after each step. Record evidence as work proceeds and present one final review packet.
-- `stepReview: "every"`: after a working step, show its diff and evidence, then wait for approval before the next step. A walkthrough is available on request.
-- `checkpointCommits: "disabled"`: omit ordinary checkpoint offers.
-- `checkpointCommits: "enabled"`: offer an optional checkpoint at the configured review boundary (per-step for `every`, final packet for `feature`). Show the exact candidate and obtain commit authorization before committing. The setting itself is not authorization.
-
-Independent-review checkpoints follow their separate contract below. Review cadence never authorizes commit, merge, push, or deployment.
+This skill turns that spec into code, following the build loop in
+`devflow/context/ai-interaction.md`, without vibe coding: small steps, a visible diff plus
+a plain-English explanation for each, testing, and iteration until it works, all
+behind your approval. It builds on a branch and offers an optional commit
+checkpoint after each step; the work-level commit, merging, and logging are
+`/complete`'s job.
 
 ## Multi-Run Target & Ticket-Driven Target Resolution
 
-- **Given an ID or name** (e.g. `/implement 12`, `/implement 012`, `/implement kanban`) -> locates the matching run folder `devflow/context/{xxx-slug}/`, selects the branch matching the run type and configured prefix, and loads only that run's `spec.md`.
-- **With no argument** (`/implement`) -> checks the current feature, fix, or rollback branch against the configured prefixes, or auto-picks if only 1 spec is active in `devflow/context/`, or prompts the user if multiple specs are queued.
+- **Given an ID or name** (e.g. `/implement 12`, `/implement 012`, `/implement kanban`) -> locates the matching run folder `devflow/context/{xxx-slug}/`, checks out `feature/{xxx-slug}`, and loads only that run's `spec.md`.
+- **With no argument** (`/implement`) -> checks current git branch matching `feature/{xxx-slug}`, or auto-picks if only 1 spec is active in `devflow/context/`, or prompts the user if multiple specs are queued.
 - **Ticket Input (`--ticket <NN | path>`)**: Targets a specific tracer-bullet ticket directly (e.g. `/implement 12 --ticket 01`, `/implement --ticket 02`, `/implement --ticket issues/01-auth.md`, or `/implement 01` when run-id is not ambiguous).
 
 ### Ticket Discovery Hierarchy
@@ -86,23 +80,23 @@ receipt. After the final Verify pass, an active gate routes to
 `current` freshness may proceed toward `/complete`. This skill never approves
 its own work or rewrites receipt evidence.
 
-For browser-facing changes, run focused browser tests during iteration when available. Run the required `npm run test:browser` gate once before handoff if the spec or project requires it. Use `browseros-neo` for visual or behavioral evidence when available and relevant. Record missing tooling accurately; install a runner only when setup is in the authorized scope.
+For a browser-facing step, run `npm run test:browser` when the script exists and
+record the result in the step evidence. Use `browseros-neo` for the interactive
+handoff when it is available and the done-when is visual or behavioral. When the
+script or MCP is absent, report that exact limitation; do not silently install a
+runner or claim browser evidence.
 
 **Resuming?** If the spec already has some build steps checked off (`- [x]`), this
 feature was started earlier and interrupted (often a cleared context). The spec and
 its ticked steps are files, so pick up where it left off: read which steps are done,
 check the git branch and `git status`/log to see what is committed and what is still
 in the working tree, then continue from the **first unchecked step** instead of
-### Step 0 - Mechanical Input Coverage Pre-flight Gate
-
-Before touching code or executing build tasks, perform a positive **Input Coverage Test** against the active Living Spec:
-- Enumerate every value, state, or data field this implementation must produce, compute, or display (from the acceptance criteria and spec design).
-- For each required value, verify that the spec explicitly names where it comes from (e.g. database schema/column, API request parameter, calculated derivation from a named source, or explicit prior architectural decision).
-- **Anti-Hallucination Guard**: Any required value with no named source is an **Owed Decision**. Do NOT rationalize it as "just wiring" and do NOT silently invent an ad-hoc provider, schema field, or business rule. Stop and route to `/grill` or request user clarification before proceeding.
+starting over.
 
 ## Step 1 - branch
 
-Create or select the branch for the spec using `git.featureBranchPrefix`, `git.fixBranchPrefix`, or `git.rollbackBranchPrefix` from config (defaults: `feature/`, `fix/`, `rollback/`). Preserve unrelated working-tree changes before switching. If the
+Create and check out a branch named from the spec: `feature/{xxx-slug}` for a feature,
+`fix/{xxx-slug}` for a fix, or `rollback/{xxx-slug}` for a Type: Rollback spec. If the
 project isn't a git repo yet, say so and ask the user to run `git init` first;
 the loop needs branches. On resume, the branch already exists - check it out
 instead of creating a new one.
@@ -111,23 +105,99 @@ instead of creating a new one.
 
 When implementing a rollback task, follow the exact safety procedure in `reference/rollback-implementation.md`.
 
-## Step 2 - implement and verify
-
-Work in small reviewable diffs, keeping progress in the selected spec.
-
-1. For logic or behavior changes with the test gate on, use Red-Green-Refactor: write a focused failing test, confirm the assertion fails for the missing behavior, implement the smallest change, then refactor with affected tests green. Preserve the user's existing work. Consult [TDD anti-patterns](tdd-anti-patterns.md) when test design needs it.
-   - **Proportional Engineering**: Add an abstraction, dependency, service, configuration surface, compatibility layer, or security mechanism only when the approved spec or an established repository requirement needs it now. Prefer existing code, standard library, and native platform features.
-2. Match the step's done-when and run focused checks. Documentation or formatting-only edits use structural checks and review; they do not require artificial unit tests. Capture relevant runtime or browser proof for behavioral criteria, following the selected Check policy.
-3. Fix failures caused by the change and rerun affected checks without requesting authorization again. Broaden verification when dependencies, failures, or risk justify it.
-4. Record the diff summary and evidence. Mark a step complete once its done-when passes and any configured per-step review has been approved. A repaired finding becomes `fixed` with resolution evidence; only a subsequent audit can close it. Apply the review cadence above before proceeding.
-
-Run a proportionality check before final verification: every new abstraction, dependency, service, configuration surface, compatibility layer, and security mechanism must trace to the approved spec or an established repository requirement. Remove speculative machinery this work added without weakening real trust-boundary validation, data-loss prevention, accessibility, or configured verification.
-
-At the final handoff, run the exact documented Verify command and all required gates. If there is no Verify command, use the project's declared build and test commands. Reuse a passing result for unchanged inputs within this pass; rerun affected gates after subsequent edits. Do not add tests or tools just to inflate the verification matrix.
-
-### Ticket execution
-
-When a ticket is selected, use its acceptance criteria as the steps above. Mark completed criteria in the ticket, mark it `done` after its criteria and required verification pass, and mirror status and evidence into the run's spec. A ticket handoff runs required gates once; criteria within the ticket use focused checks. A request to finish the whole run continues through the dependency frontier until the authorized scope is verified.
+## Step 2 - build one step, review, iterate, checkpoint (Strict TDD)
+
+Work through the spec's build steps in order, one at a time. For each step:
+
+1. **Strict TDD Cycle (for logic & behavior changes)**:
+   - **🔴 RED**: Write the unit test first in the relevant test file. Execute the test command and show the failing assertion output.
+   - **🟢 GREEN**: Implement only the minimal code in the source file necessary to make the test pass. Re-run test and show passing output.
+   - **🔵 REFACTOR**: Refactor and format cleanly, verifying that 100% of tests remain green.
+   - *Code Reversion Rule*: If production code is written without a prior test for behavior changes, revert it and write the test first.
+
+   **⚖️ The Iron Law**: `NO PRODUCTION CODE WITHOUT A FAILING TEST FIRST` — Apply to behavior changes according to the spec's test decision. If code came first, revert only your own work for that step and restart from the test, preserving the user's existing work.
+
+   **Red-Phase Verification (confirm all three before GREEN):**
+   - The test actually fails, rather than encountering a syntax error
+   - The error message identifies missing behavior, rather than invalid configuration
+   - The failure reflects the behavior under test, rather than a bug in the test itself
+
+   **Green-Phase Discipline**: Write the minimum code needed to pass the test; add only the options/features it requires (YAGNI constraint).
+
+   > 📖 For anti-patterns and Bad vs Good examples, read [`tdd-anti-patterns.md`](tdd-anti-patterns.md).
+
+2. Implement just that step: the smallest change that satisfies its "done when."
+3. Show the **diff**, not whole files.
+4. **Explain it, and prove it.** Give a short summary: what the step delivered,
+   one line per changed file on what it does and why, then confirm the step's
+   "done when" is met with empirical evidence (test pass output, build output, or screenshot). This summary is the comprehension gate, so keep it concrete, not
+   vague. Include a short **How to try it** note when the step has a manual
+   path: the command, URL, click, endpoint, or output the user can check.
+5. **Verify the step.** If `AGENTS.md` declares a `Verify` command, run that exact
+   command as the automated gate. It is only an umbrella for checks the project
+   actually has, so do not invent tests or other checks to satisfy it. If no
+   `Verify` command exists, run the documented build command and the test command
+   when the project declares one. A step that adds logic must ship a passing test
+   in the same diff when the test gate is on, and the suite must be green before
+   the step is approved (see the Testing gate in `coding-standards.md`). UI and
+   integration-only steps ride on screenshot plus build evidence. Run a focused
+   test separately when it gives faster feedback, then use `Verify` as the final
+   automated gate. For UI or integration done-whens, prefer Playwright when it is
+   already installed or declared in `AGENTS.md`; do not add it silently for an
+   unrelated feature. Create focused test files next to the source they cover,
+   per `coding-standards.md`. Never install a runner mid-step unless the current
+   spec is explicitly the unit-testing setup itself (for example `/fix "add unit
+   testing"`). If a step surfaces non-trivial logic the spec did not foresee, add
+   a focused test then, or note why not. When a step's done-when is behavioral (a
+   click, a download, or a flow across screens), run `/check` to prove it against
+   the running app rather than eyeballing it.
+5. **Iterate until it works.** If it fails or the user wants changes, revise the
+   step (re-prompt or hand-edit the code), show the updated diff, and re-test.
+   Repeat until it works and the user approves. Nothing is committed until the
+   user is happy with the step.
+6. **Mark it done, then prompt to move on.** Once the step is approved, check that
+   step off (`- [x]`) in `devflow/context/{xxx-slug}/spec.md` so progress survives a context
+   clear. If the step repaired a finding tracked in
+   `devflow/context/{xxx-slug}/findings.md`, set that finding's status to `fixed` now too
+   and note the repair in its **Resolution** line. Never set `closed`: a repair
+   is re-reviewed by `/audit` before it clears, because a fix can introduce a
+   worse defect than the one it removed. Then offer a short choice, noting that checkpoints are optional since
+   `/complete` makes the real feature-level commit. Use the current tool's short
+   user-input prompt when available; when you've just produced a long block to
+   read (a deep explanation, a big
+   walk-through), ask in plain text instead, so the prompt doesn't cover what the
+   user is still reading:
+   - **Continue** (default) - roll into the next step without committing.
+   - **Commit checkpoint** - commit just this step on the branch with a
+     conventional message (a cheap rollback point).
+   - **Walk me through it** - give a deeper, line-level explanation of the new or
+     changed code (why this approach, what each part does, any gotchas), then
+     re-ask this checkpoint prompt. A loop-back, not a terminal choice.
+   - **Stop here** - pause the loop so the user can review or come back later.
+
+   On **Continue** or after **Commit checkpoint**, go to the next step. On **Walk
+   me through it**, explain in depth and then re-ask this prompt in plain text (the
+   explanation is long, so a modal would cover it). On **Stop here**, stop and say
+   where things stand: the branch is intact; run `/implement` again to resume, or
+   `/complete` to wrap up what's built so far.
+
+### Ticket-Driven TDD Execution (when working from a Ticket)
+
+When executing a tracer-bullet ticket (via `--ticket` or auto-frontier):
+1. **Extract Scope**: Read *What to build* and *Acceptance criteria* checklist (`- [ ]`) from the active ticket file.
+2. **Strict TDD Cycle per Criterion**:
+   - **🔴 RED**: Write the unit/integration test for the criterion first at the agreed seam. Execute the test command and verify the expected failing assertion.
+   - **🟢 GREEN**: Implement only the minimal code in the source file necessary to make the test pass. Re-run test and show passing output.
+   - **🔵 REFACTOR**: Refactor and format cleanly, verifying that 100% of tests remain green.
+3. **Verify Gate**: Run the project's Verify command (`npm run check` or documented test suite) to ensure whole-system health before concluding the ticket.
+4. **Bidirectional State Sync**:
+   - Mark each completed criterion `- [x]` in the ticket file.
+   - Once all criteria in the ticket pass, update the ticket status to `**Status:** done` (or `Status: done`).
+   - Mirror the completed work, status, and diff evidence into `devflow/context/{xxx-slug}/spec.md` (under `## 📋 3. Execution Plan & TDD Checklist` and `## ⚡ 4. Implementation Log & Evidence`) so the Living Spec remains the authoritative single source of truth for `/check`, `/audit`, and `/complete`.
+
+Never batch the whole thing into one diff. If a step's diff is too big to read,
+split it. The documented `Verify` command, or the fallback build and tests, must
+pass before any commit.
 
 After final Verify and required Check pass, set the active spec to `verified`
 with every completed box checked. Then resolve independent review before the
@@ -200,19 +270,23 @@ named area. If the feature spans too many distinct areas for one useful pass,
 name the sections first and let the user choose where to begin. Remain read-only
 unless the user separately requests changes.
 
-Ordinary checkpoint commits are available only through the configured review boundary and explicit candidate approval above. The immutable independent-review checkpoint also requires explicit candidate approval. Work-level completion commits belong to `/complete`. Configuration never supplies commit approval. Never merge, push, deploy, publish,
+Never create an ordinary step, product, or work-level commit from this skill.
+The sole exception is exactly one immutable independent-review checkpoint after
+showing its exact candidate and receiving current explicit commit approval.
+Configuration never supplies that approval. Never merge, push, deploy, publish,
 or start unrelated work from this skill.
 
 ## Rules
 
-- Keep diffs small and apply the configured review cadence.
+- One small step per diff; the user reviews and approves each before any commit.
 - Explain every change in plain English. Understanding the code is the point.
 - Iterate on the branch until each step works; never commit code the user hasn't
   approved.
 - Follow `devflow/context/coding-standards.md` (server vs client, scope user-owned queries
   by the authenticated user id, validate inputs, and so on).
-- Keep the spec aligned with the authorized scope. Correct routine omissions with evidence; ask only when a material scope or design decision is unresolved.
-- Configured checkpoint offers are optional. The work-level commit, the merge,
+- Build only what the spec says. If the spec is wrong or thin, stop and fix the
+  spec first, do not improvise.
+- Per-step commits are optional checkpoints. The work-level commit, the merge,
   and any push are `/complete`'s job.
 - For Type: Rollback, reverse only the approved product diff and preserve all
   protected Blueprint paths.

package/template/.agents/skills/setup-tests/reference/browser.md

@@ -0,0 +1,95 @@
+# Browser test setup
+
+This is an explicit optional setup command. It creates a project-owned browser
+test path that later Feature, Implement, Check, and Continuous runs can reuse. It
+does not replace live browser inspection, install during another workflow
+command, or make browser testing mandatory for every DevFlow project.
+
+> 💡 **Nexus-DevFlow Superpower**:
+> Nexus-DevFlow also provides the dedicated first-class skill **`/browser-tests`** which natively connects with Playwright test harnesses and the user's MCP `browseros-neo` (live real-browser inspection). Both paths are fully supported under DevFlow Dual Compatibility.
+
+## Input
+
+This reference is selected by `/setup-tests browser`, `/tests browser`, or an explicit request to set up
+browser or end-to-end testing. A named runner, browser, application surface, or
+flow is a preference to verify against the real project.
+
+## Step 1 - inspect the project
+
+Read enough files to identify the actual browser surface and existing setup:
+
+- `AGENTS.md`, especially Commands and any Verify command
+- package or language manifests, lockfiles, workspaces, and runtime versions
+- existing browser, integration, and end-to-end test configs and files
+- build, dev, preview, extension-build, and test commands
+- relevant CI workflows and ignore rules
+- `devflow/context/coding-standards.md`
+- Git branch and worktree state
+
+Do not assume Node.js, npm, a web server, or a blank test setup. Do not install
+dependencies or edit files during inspection.
+
+## Step 2 - choose the smallest useful harness
+
+Reuse a working browser runner already established by the project. For a
+compatible JavaScript or TypeScript web app or browser extension with no runner,
+prefer Playwright Test. If the stack or executable surface is unclear, stop and
+ask instead of inventing a framework.
+
+Choose one representative smoke path through a real project surface. It must
+prove the harness can launch the app and observe behavior, not merely assert that
+a static fixture exists. Keep authentication state, profiles, secrets, generated
+reports, traces, videos, and screenshots out of Git unless the project already
+has a deliberate safe convention.
+
+## Step 3 - present the setup
+
+Before editing, state:
+
+- runner selected or reused
+- exact dependency install command, when needed
+- config, script, test, and ignore files to add or change
+- application or extension surface covered by the smoke test
+- exact browser-test command that will be documented
+- any server, build, authentication, or browser-chrome limitation
+
+Dependency installation and browser-binary downloads require the user's approval
+through the current tool's normal approval flow. Do not treat running this skill
+as permission to change CI, download unrelated browsers, or add a broad suite.
+
+## Step 4 - create or normalize the harness
+
+Make the smallest practical diff:
+
+1. Add only the required runner dependency and config.
+2. Add one project-relevant smoke test.
+3. Add or reuse a conventional command such as `test:browser`.
+4. Document the exact invocation in the Commands section of `AGENTS.md` as
+   `Browser tests: <command>`. Include a working directory when a workspace
+   needs one.
+5. Configure runner-owned server lifecycle only when the project has a safe,
+   documented command and the runner can start and stop it reliably. Do not
+   create a duplicate server when the established harness reuses one.
+6. Ignore generated browser-test artifacts that should stay local.
+
+Do not add browser tests to the default Verify command or GitHub workflow unless
+the user separately asks for that slower gate or the project already requires
+it. Preserve existing CI and existing browser coverage.
+
+## Step 5 - verify the path
+
+Run the documented Browser tests command. Confirm that the smoke test exercises
+the intended real surface and that the runner exits cleanly. Inspect generated
+console, request, trace, screenshot, or report evidence only when relevant to
+the claim.
+
+## Step 6 - report
+
+Return a concise setup report:
+
+- runner and browser surface
+- command documented in `AGENTS.md`
+- smoke behavior proven
+- files added or changed
+- verification result
+- remaining manual or environment-specific boundary

package/template/.agents/skills/test/SKILL.md

@@ -87,32 +87,6 @@ When generating or logging test runs during `/implement` or `/check`:
 
 ---
 
-## 7. 5-Tier Test File Classification Strategy
-
-Do not write identical test patterns for all file types. Classify files into 5 distinct tiers:
-
-| Tier | Category / File Paths | Recommended Test Strategy | What NOT to do |
-| :--- | :--- | :--- | :--- |
-| 🧠 **Tier 1** | **Pure Logic & Algorithms**<br>`src/utils/`, `src/services/`, `lib/` | Fast in-memory Unit Tests with 100% boundary & edge cases coverage. Use TDD (Red-Green-Refactor). | Do not over-mock pure mathematical or transformation functions. |
-| 🎨 **Tier 2** | **UI Components**<br>`src/components/`, `src/pages/` | Component rendering, event dispatching, visual verification via Playwright / BrowserOS Neo. | **Prohibited**: Do not write trivial unit tests that merely assert static HTML tags exist. |
-| 🔌 **Tier 3** | **API & Data Integration**<br>`src/api/`, route handlers, DB models | Contract tests, schema validation (Zod), HTTP status codes, error payload shapes. | Do not test external third-party network APIs without isolated fakes. |
-| ⚙️ **Tier 4** | **Config & Build Tooling**<br>`*.json`, `*.yaml`, `scripts/` | Static contract validation (`npm run check:static`), budget linters (`npm run check:budgets`), smoke tests. | Do not skip static validation on build tool modifications. |
-| 📝 **Tier 5** | **Documentation & Prose**<br>`*.md`, `devflow/docs/` | Structural checks, markdown contract scans, and link integrity verification. | Do not write artificial unit test suites for documentation files. |
-
----
-
-## 8. Acceptance Criteria (`AC-N`) Traceability Protocol
-
-To guarantee 100% spec fidelity, every automated test suite must trace back to the active Living Spec:
-- **Test Title Tagging**: Prefix test titles or describe blocks with the target Acceptance Criterion:
-  ```typescript
-  it('AC-1: enforces 32KB byte budget on SKILL.md files', async () => { ... });
-  it('AC-2: returns exit code 1 when budget violation occurs', async () => { ... });
-  ```
-- **Traceability Verification**: During `/check`, cross-reference every `- [ ] AC-N` against the passing test assertion name to ensure zero untracked requirements.
-
----
-
 ## Relationship To DevFlow 2.6.x
 
 - **Classification**: Companion command & Engineering standard

package/template/.claude/skills/audit/SKILL.md

@@ -300,10 +300,8 @@ expectations. Apply only the selected lens or lenses:
   - *Question Intent & Simpler Alternatives*: State what the change actually attempts in one sentence. Ask: is there a simpler, smaller, or more elegant way to achieve the same goal (reusing existing code, config vs code, solving at a different layer)?
   - *Full Call-Path Tracing*: Follow the call graph through real code paths (entry point → call sites → branches taken → state mutated → exit/side effect), including unchanged code on either side of the diff where bugs hide.
   - *Verify Claims & Edge Cases*: Does the traced path actually produce the claimed behavior? What inputs/states would break it (concurrency, retries, null/unicode/huge payloads, ordering)? What does it silently change?
-  - *Assumed Decision Debt Check*: Scan `devflow/decisions/` for any ADR with `Status: Assumed`. Flag unratified assumptions as `Q-xxx` (P2) to ensure ratification before production handoff.
   - *No Rubber-Stamping*: "LGTM" is prohibited. State what was traced, what was verified, and what evidence supports the verdict.
 
-
 Do not nitpick harmless style differences unless they signal drift from the local
 patterns. Prefer a short list of real findings over a broad list of guesses.
 
@@ -321,8 +319,7 @@ Maintain the durable record in `devflow/context/{xxx-slug}/findings.md` (or `dev
 3. Set severity honestly:
    - `P0`: critical blocking bug, data corruption, severe vulnerability, complete outage.
    - `P1`: serious defect, missing critical test, unhandled core error.
-   - `P2`: moderate debt, performance degradation, missing edge cases, or pure proportionality finding.
+   - `P2`: moderate debt, performance degradation, missing edge cases.
    - `P3`: minor improvement, code cleanup, cosmetic tweak.
-   *(For a proportionality finding, state in Suggested fix what can be deleted. An otherwise pure proportionality finding is P2 or P3. Raise to P0/P1 only when the unnecessary machinery causes a concrete reachable defect or violates an established security or data-integrity boundary.)*
 4. Set status: `open`, `fixed`, `closed`, `accepted`, or `invalid`.
 5. Display concise findings summary and next actions.

package/template/.claude/skills/brainstorm/SKILL.md

@@ -29,11 +29,10 @@ Use this when:
 - Identify technical, business, or timeline constraints.
 
 ### 2. Option Formulation (Divergent Phase)
-Provide at least 2-3 materially distinct approaches. Where applicable, map each option to its **Slicing Archetype** ([`devflow/reference/slicing-archetypes.md`](file:///d:/Projects/devtools/nexus-devflow/devflow/reference/slicing-archetypes.md)):
-- **Option A (Standard / Conservative)**: Low risk, proven pattern, minimal changes (e.g. *Skateboard* or *Tracer Bullet*).
-- **Option B (Modern / Optimized)**: Best-practice architecture, balanced trade-off, scalable (e.g. *Journey*).
-- **Option C (Alternative / Fast-Feedback)**: High innovation, simplified scope, or UX-first (e.g. *Facade*).
-
+Provide at least 2-3 materially distinct approaches:
+- **Option A (Standard / Conservative)**: Low risk, proven pattern, minimal changes.
+- **Option B (Modern / Optimized)**: Best-practice architecture, balanced trade-off, scalable.
+- **Option C (Alternative / Unconventional)**: High innovation, simplified scope, or creative alternative.
 
 ### 3. Trade-off Comparison Matrix
 Construct a structured evaluation table:

package/template/.claude/skills/bughunter/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: bughunter
-description: "[devflow] Investigate security vulnerabilities with evidence. Use for /bughunter or an authorized security review of code or endpoints."
+description: "[devflow] Offensive security orchestrator & bug hunting guide. Indexes 83 vulnerability classes, 5-phase methodology (Think, Hunt, Perimeter, Ship), 681 disclosed HackerOne patterns, and JIT reference guides in devflow/.vendor/bughunter/. Use when running /bughunter, performing security reviews, verifying auth/injection risks in /check or /audit, or testing API endpoints for vulnerabilities."
 argument-hint: "[{target, vuln-class, or topic}]"
 ---
 

package/template/.claude/skills/check/SKILL.md

@@ -1,36 +1,126 @@
 ---
 name: check
-description: "[devflow] Check the running app, CLI, or server against the active spec's done-when criteria and capture observable pass or fail evidence without editing source. Use /check to verify real feature behavior, or /check guide [latest|scope] for a read-only manual walkthrough: how to test manually, where to click, expected and incorrect results, or a human review path."
-argument-hint: "[guide] [latest | <step> | <path> | <route>]"
+description: "[devflow] Check the running app, CLI, or server against the active spec's done-when criteria and capture observable pass or fail evidence without editing code. Use for /check, proving behavior before completion beyond builds and tests."
+argument-hint: "[{run-id, number, or name}]"
 ---
 
-# check - verify behavior or explain how to try it
+# check - Dual-Axis Independent Verification Engine
 
-**Context reuse:** Reuse any required file already loaded in project instructions or the current session. Read it again only if absent, changed, or exact current bytes or line references are needed.
+$ARGUMENTS
 
-## Select the mode before any tool call
+**First action:** Before project inspection, preflight, or any other tool call,
+publish `running` to `devflow/.state/run.json` using the dashboard activity
+contract in `AGENTS.md`.
 
-- `/check guide` or `$check guide`: generate a read-only manual walkthrough.
-  Pass remaining arguments such as `latest`, a step, a path, route, or command
-  to `reference/guide.md`. Read and follow that reference only. Do not write
-  activity state, run checks or the app, edit files, update spec status, or
-  produce verification receipts.
-- A natural-language request for instructions on how the user can manually test
-  or review a change also selects guide mode. If the request mixes a guide with
-  agent verification, clarify which mode to run first before any activity.
-- `/check` or `$check`, optionally with a verification scope: verify observed
-  behavior against the spec. Follow verification startup below, then read and
-  follow `reference/verify.md` only.
+Where this sits in the workflow:
 
-Load only the selected reference. Do not read both references preemptively.
-Guide generation never satisfies a verification gate. The existing
-`qualityGates.regular.tryGuide` and `qualityGates.continuous.tryGuide` keys now
-select `/check guide`; their policy values and automatic invocation rules are
-unchanged. The separate `check` gates continue to select verification mode.
+    /implement  ->  [check]  ->  /complete
+    (built a       (dual-axis       (only once both
+     step or        review with      axes pass with
+     the feature)   empirical proof) evidence)
 
-## Verification startup (verification mode only)
+`/implement` builds and does a quick build-plus-screenshot check inline. `/check` is the rigorous, repeatable gate for when a feature or step needs **empirical proof** on the running app and **two-axis code review** before merging.
 
-**First action:** Before project inspection, preflight, or any other tool call,
-publish `running` to `devflow/.state/run.json` using the dashboard activity
-contract in `AGENTS.md`, with command `check`. This precedes reading the
-verification reference. Guide mode must skip this startup entirely.
+It changes no source and commits nothing — it executes, inspects, and reports observed facts.
+
+---
+
+## Input
+
+- **Given an ID or name** (e.g. `/check 12`, `/check 012`) -> targets `devflow/context/{xxx-slug}/` and records audit ledger to `{xxx-slug}/findings.md`.
+- **With no argument** (`/check`) -> verifies the active run matching current git branch or single active spec.
+
+---
+
+## Hybrid Browser Verification Engine
+
+Nexus-DevFlow uses a **Dual-Layer Browser Verification Hierarchy**:
+
+```text
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                    🌐 Hybrid Browser Verification Engine                    │
+├──────────────────────────────────────┬──────────────────────────────────────┤
+│ 1. Code-Driven Test Automation (CI)  │ 2. Interactive AI Visual QA (MCP)    │
+│    • Framework: Playwright           │    • Server: MCP browseros-neo       │
+│    • Command: npm run test:browser   │    • URL: http://127.0.0.1:9010/mcp  │
+│    • Purpose: Assertions, Headless,  │    • Purpose: Live DOM Inspection,   │
+│      Regression Suite & Pre-commit   │      Real Screenshot Proofs, /try    │
+└──────────────────────────────────────┴──────────────────────────────────────┘
+```
+
+1. **Layer 1: Code-Driven Repeatable Tests (Playwright)**:
+   - If `AGENTS.md` declares `Browser tests: <command>`, run that exact command as repeatable automated evidence.
+2. **Layer 2: Interactive AI Visual QA (MCP browseros-neo)**:
+   - When the `browseros-neo` MCP server (`http://127.0.0.1:9010/mcp`) is active, use it to inspect the live running app, verify rendered CSS/layout, test click flows, and capture actual screenshot proofs.
+
+---
+
+## Step 1 - Build the Dual-Axis Review Matrix
+
+Read the target spec from `devflow/context/{xxx-slug}/spec.md` and `devflow/context/coding-standards.md`. Prepare the inspection criteria across two independent axes:
+
+1. **Axis 1 (Standards & Architecture Criteria)**:
+   - Coding conventions in `coding-standards.md`
+   - Deep Modules discipline (Small interface, deep implementation, clean seams, no leaky abstractions)
+   - Baseline 12 Fowler Code Smells (Primitive obsession, Feature envy, Shotgun surgery, Speculative generality, etc.)
+   - Multi-lane technical gates (Typecheck, test suites, zero secrets, zero P0/P1 findings)
+2. **Axis 2 (Spec Fidelity & Behavioral Observables)**:
+   - Line-by-line Acceptance Criteria (ACs) and "Done When" observables from `devflow/context/{xxx-slug}/spec.md`
+   - Scope Creep detection (Unrequested behavior in the diff)
+   - Missing Requirements detection (Unimplemented edge cases)
+
+---
+
+## Step 2 - Get the App Running & Exercise Live Proof
+
+Use the project's real commands (from `AGENTS.md`):
+
+- **Web app**: Start (or reuse) the local dev server. Drive a real browser to relevant routes. If `Browser tests: <command>` is declared, run it. When MCP `browseros-neo` is active, connect to inspect live visual state.
+- **CLI**: Execute commands with representative input fixtures, asserting exit codes and output snapshots.
+- **Server / API**: Hit endpoints with real payloads and assert on HTTP response status and bodies.
+- **Library**: Exercise public interfaces through integration tests or sample scripts.
+
+> [!IMPORTANT]
+> **Evidence or it didn't happen**: Every verdict must be backed by empirical evidence (screenshot, command output, status code, response time). Never assume a pass from reading source code alone.
+
+---
+
+## Step 3 - Dual-Axis Independent Report & State Update
+
+Format the report into two distinct, un-merged review axes:
+
+```markdown
+# 🔍 Verification Report: [Feature Name]
+
+## ⚖️ Axis 1: Standards, Architecture & Quality Gate
+
+- **Technical Lanes**:
+  - [pass] Type Safety: `tsc --noEmit` (0 errors)
+  - [pass] Automated Tests: `npm test` (All tests green)
+  - [pass] Browser Tests: `npm run test:browser` (Playwright passed)
+  - [pass] Visual Inspection: MCP browseros-neo verified UI layout & zero console errors
+  - [pass] Security & Hygiene: Zero secrets, sanitized inputs
+  - [pass] Findings Ledger: 0 blocking P0/P1 in `devflow/context/{xxx-slug}/findings.md`
+- **Deep Modules & Architecture**:
+  - [pass] Seam Integrity: Public interfaces remain small, implementation details hidden.
+  - [pass] The Deletion Test: Complexity is concentrated inside the module, not scattered across callers.
+- **Code Smells Assessment**:
+  - [clean] 12 Fowler Code Smells evaluated across git diff: No critical smells detected.
+
+## 🎯 Axis 2: Spec Fidelity & Behavioral Acceptance Gate
+
+Line-by-line verification against `devflow/context/{xxx-slug}/spec.md`:
+- [pass] **AC-1 (<title>)**: <Observed empirical evidence / screenshot path>
+- [pass] **AC-2 (<title>)**: <Observed empirical evidence / terminal output>
+- [fail] **AC-3 (<title>)**: <Exact observed failure with reproduction command>
+- [clean] **Scope Creep Check**: No unrequested features or unnecessary abstractions introduced.
+- [clean] **Completeness Check**: 100% of spec requirements addressed.
+
+---
+
+## 🚦 Final Routing & Verdict
+
+- **ALL PASSED**: Both axes green. Update `stage.md` (Passed -> Ready for `/complete`).
+- **ANY FAILURE**: Hand back to `/implement` with exact failure evidence and reproduction steps.
+- **UNVERIFIABLE**: Clearly document the gap and residual risk. Never fabricate a pass.
+```